dex-oracle - A pattern based Dalvik deobfuscator which uses lim

项目说明

Oracle

A pattern based Dal which uses limited execution to impro analysis. Also, the inspiration for another Android deobfuscator: Simplify.

![Gem ]()
![Code Climate]()
![Test Co]()

Before
!before

After
!after

_sha1: a68d5d2da7550d35f7dbefc21b7deebe3f4005f3_

_md5: 2dd2eeeda08ac8c15be8a9f2d01adbe8_

Installation

Step 1. Install Smali / Baksmali

Since you're an elite Android re, I'm sure you already ha and Baksmali on your path. If for some strange reason it's not already installed, this should get you started, but please examine it carefully before running:

Step 2. Install Android SDK / ADB

Make sure adb is on your path.

Step 3. Install the Gem

Or, if you prefer to build from source:

Step 4. Connect a Device or Emulator

_You must ha an emulator running or a device plugged in for Oracle to work. The minimum required Android is 5.0!_

Oracle needs to execute methods on an li system. This can either be on a device or an emulator (preferred). If it's a device, _make sure you don't mind running potentially hostile code on it_.

If you'd like to use an emulator, and already have the Android SDK installed, you can create and start emulator images with:

Usage

For example, to only deobfuscate methods in a class called Lcom/android/system/admin/CCOIoll; inside of an APK called obad.apk:

How it Works

Oracle takes Android apps (APK), Dal (DEX), and Smali files as inputs. First, if the input is an APK or DEX, it is disassembled into Smali files. Then, the Smali files are passed to plugins which perform analysis and modifications. Plugins search for patterns which can be transformed into something easier to read. In order to understand what the code is doing, some Dal are actually executed with and the output is collected. This way, some method calls can be replaced with constants. After that, all of the Smali files are updated. Finally, if the input was an APK or a DEX file, the modified Smali files are recompiled and an updated APK or DEX is created.

Method execution is performed by the Driver. The input APK, DEX, or Smali is combined with the Driver into a single DEX using dexmerge and is pushed onto a device or emulator. Plugins can then use Dri uses Ja to execute methods from the input DEX. The return can be used to impro analysis beyond mere pattern recognition. This is especially useful for many string decryption methods, which usually take an encrypted string or some byte array. One limitation is that execution is limited to static methods.

Hacking

Creating Your Own Plugin

There are three plugins which come with Oracle:

1. Undexguard - remo types of Dexguard obfuscations
2. Unreflector - removes some Ja
3. String Decryptor - simple plugin which removes a common type of string encryption

If you encounter a new type of obfuscation, it may be possible to deobfuscate with Oracle. Look at the Smali and figure out if the code can either be:

1. rearranged
2. understood by executing some static methods

If either of these two are the case, you should try and write your own plugin. There are four steps to building your own plugin:

1. identify Smali patterns
2. figure out how to simplify the patterns
3. figure out how to interact with driver and invoke methods
4. figure out how to apply modifications directly

The included plugins should be a good guide for understanding steps #3 and #4. Driver is designed to help with step #2.

Of course, you're always welcome to share whate you come across and someone may e get to it.

Updating Driver

First, ensure dx is on your path. This is part of the Android SDK, but it's probably not on your path unless you're hardcore.

The driver folder is a Ja managed by Gradle. Import it into Eclipse, IntelliJ, etc. and make any changes you like. To finish updating the driver, run ./update_driver. This will rebuild the driver and convert the output JAR into a DEX.

Troubleshooting

If there's a problem executing driver code on your emulator or device, be sure to open monitor (part of the Android SDK) and check for any clues there. Even if the error doesn't make sense to you, it'll help if you post it along with the issue you'll create.

Not all Android platforms work well with dex-oracle. Some of them just crap out when trying to execute arbitrary DEX files. If you're having trouble with Segfaults or dri, try using Android 4.4.2 API level 19 with ARM.

It's possible that a plugin sees a pattern it thinks is obfuscation but is actually some code it shouldn't execute. This seems unlikely because the obfuscation patterns are really unusual, but it is possible. If you're finding a particular plugin is causing problems and you're sure the app isn't protected by that particular obfuscator, i.e. the app is not DexGuarded but the DexGuard plugin is trying to execute stuff, just disable it.

More Information

1. TetCon 2016 - Android Deobfuscation
2. Hacking with dex-oracle for Android Malware Deobfuscation

项目信息

开发语言：Ruby

Star 数：504

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A pattern based Dalvik deobfuscator which uses limited execution to improve semantic analysis展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。